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We present DiffSum, a simple risk-limiting post¬ 
election ballot-polling audit. See [HIT] for background. 

You wish to check that candidate A really won a plu¬ 
rality election against candidate B. You may sample the 
n cast paper ballots without replacement. 

Procedure DiffSum: 

1. [Choose c] Let d be the number of dec¬ 
imal digits in n, and choose c = d + 6 
where S controls the error rate (the chance 
of the audit accepting an incorrect outcome): 
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2. [Begin] Draw an initial sample of 24 ballots. 

3. [Tally] Determine the number a of votes for A 
in your sample, and the number b of votes for B. 

4. [Stop?] Stop the audit (accept A as winner) if 
a > b and 

{a — b)'^ > c ■ {a + b) . (1) 

5. [Continue?] It a + b = n, stop (you have just 
completed a full recount). Otherwise, enlarge 
your random sample and return to step 3. 

Remarks: The initial size 24 of the sample in step 2 is 
arbitrary. In step 5 the increase in sample size is also 
arbitrary; it could be by a single ballot. 

The name “DiffSum” was chosen because m says 

(difference)^ > c • (sum) . (2) 

Efficiency: Let m be the true margin (the fraction of 
votes cast for A minus the fraction cast for B). In a 
sample of size s = a+b, the expected value of a — b is sm. 
Thus, DiffSum is expected to stop when (sm)^ > cs or 

s > clvr? (3) 

DiffSum is approximately as efficient as Bravo — 
compare m with the estimate 21n(l/a)/m^ for 
Bravo [5] (here a is the risk limit). Moreover, DiffSum 
does not need an initial estimate of the vote shares, and 
Bravo is inefficient when this estimate is inaccurate. 


Error rate: The error rate bounds given in Step 1 are 
based on extensive simulations for 5 = 0 to 4, d = 3 to 7, 
n = lO"^, and c = d + 5. We measured the error rate over 
10,000 simulated elections in each case. Each simulation 
estimated the error rate when the election was a tie, 
a worst-case scenario; with more realistic margins the 
error rate drops dramatically, so that in practice even 
c = d should give very reliable audits. 

Example: An election with n = 50,000 votes can be 
audited using c = 7 for a risk limit of a = 10%. For m = 
0.20, DiffSum examines about 175 ballots (estimated), 
Bravo (with a = 0.10) examines about 115 (estimated). 
In simulations for this election, DiffSum with c = 7 
examines about 157 ballots on average, and has an error 
rate of less than 0.04%; DiffSum with c = 5 examines 
about 112 ballots on average, and has an error rate of 
less than 0.2%. Bravo examines about 119 ballots on 
average, and has an error rate of approximately 2.5%. 

Extension: In practice, one should cease random sam¬ 
pling once a significant number (say 4%) of the ballots 
have been sampled, when switching over to a full hand 
recount becomes more economical. 

With more candidates, let DiffSum check that the 
sample winner beats the sample’s strongest loser. 
Conclusion: DiffSum is exceptionally simple, and ap¬ 
pears quite comparable to Bravo in terms of efficiency 
and error rate. Further simulations and analysis would 
be helpful. 
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